Question

What is and how to interpret the EFL under registers using OllyDbg?

What is NO, NB, E, NE, BE, A, NS ,PO, GE, G, …

Example:

EFL 00000246 (NO,NB,E,BE,NS,PE,GE,LE) 

My futile decipher:

00000246 => 0000 ... 0010 0100 0110
NO   NB   E    BE   NS   PE   GE   LE
 0    0   0     0    0    1    1    1 <- I do not know if this is correct. 
                                         (Likely not.)

Operation:

AND ESI,7FFFFFFF

Result:

EFL 00000202 (NO,NB,NE,A,NS,PO,GE,G)

My ASCII, (inspired by):

            _---------------------------=>  E -> NE
           /     _----------------------=> BE -> A
          |     /          _------------=> PE -> PO
          |    |          /          _--=> LE -> G
          |    |         |          /
          |    |         |         |
NO   NB   NE   A    NS   PO   GE   G
0000 0000 0000 0000 0000 0010 0100 0110
0    0    0    0    0    1    1    1

Help has the following to say:

Following EFL are the suffixes of conditional commands that satisfy current flags. If, for example, you see:

EFL 00000A86 (O,NB,NE,A,S,PE,GE,G),

this means that JO and JNE will be taken whereas JB and JPO not.


I suspected CPU Flags, FLAGS register, etc. but cant recognize e.g. NO in any of those.

Was it helpful?

Solution

EFL is the FLAGS register (expanded to include EFLAGS), used among other things to indicate parity, overflow/carry, direction and branch flow as well as various CPU modes.

Olly slightly expands the register by separating out the booleans for common control status bits above EFL (the singular bits named 'C P A Z S T D O').

The abbreviations in brackets next to EFL's value the correlate to what can/cannot pass under the current EFLAGS, ie: NO stands for No-Overflow, toggling the OF bit will switch it to O for overflow.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top